Adding new languages is as easy as the package manager makes it... which is normally still quite hard! The core logic for Dependabot is open-source here, including all the language-specific logic for Ruby, JS and PHP, and a starter (lots of work still required) for Python: https://github.com/gocardless/bump-core.

For the app itself, we used Ruby (because we'd built the original core gem, which was https://github.com/gocardless/bump, in Ruby at a work hackathon years ago).

Costs under £50 a month to keep running at the moment, creating about 2,000 PRs a month. We could really do with getting it into the GitHub marketplace so we can start charging people and cover those costs!